❦ 24 mars 2020 03:11 +00, Paul Wise: >> Specifically, as README.Debian states, the vendor/ subdirectory of the >> source package contains more than two hundred Go libraries. > > There are a *lot* of embedded code/data copies in Debian already. > While it would be nice to remove them, sometimes it isn't possible. > Often the copies are forked, or upstream refuses to remove them, > sometimes even though they forgot why they were added in the first > place. In addition the developer culture in various communities > encourages embedded copies. I think the best action we can do is send > patches to upstream projects to switch from vendoring to using the > native dependency system of the package manager for the related > language community. ISTR reading that Go has one of those now. Kubernetes is already using Go modules. They happen to have decided to keep shipping a `vendor/` directory but this is not uncommon. It is often considered as a protection against disappearing modules. So, there is nothing to be done upstream. And BTW, there are currently 616 dependencies, pinned to a specific version. -- Don't just echo the code with comments - make every comment count. - The Elements of Programming Style (Kernighan & Plauger)
Attachment:
signature.asc
Description: PGP signature